<!doctype html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<title></title>
	<link rel="stylesheet" type="text/css" href="http://paranoid.net.cn/semantic.css" >
</head>
<body>
<section-title-en>2.1 Overview</section-title-en>
<section-title-ch>2.1 概述</section-title-ch>
<p-en>
	A computer's main resources (§2.2) are memory and processors. On Intel computers, Dynamic Random Access Memory (DRAM) chips (§2.9.1) provide the memory, and one or more CPU chips expose logical processors (§2.9.4). These resources are managed by system software. An Intel computer typically runs two kinds of system software, namely operating systems and hypervisors.
</p-en>
<p-ch>
	计算机的主要资源（§2.2）是内存和处理器。在 Intel 计算机上，动态随机存取存储器 (DRAM) 芯片 (§2.9.1) 提供了内存，一个或多个 CPU 芯片暴露了逻辑处理器 (§2.9.4)。这些资源由系统软件管理。英特尔计算机通常运行两种系统软件，即操作系统和管理程序。
</p-ch>
<p-en>
	The Intel architecture was designed to support running multiple application software instances, called processes. An operating system (§2.3), allocates the computer's resources to the running processes. Server computers, especially in cloud environments, may run multiple operating system instances at the same time. This is accomplished by having a hypervisor (§2.3) partition the computer's resources between the operating system instances running on the computer.
</p-en>
<p-ch>
	英特尔架构的设计是为了支持运行多个应用软件实例，称为进程。操作系统（§2.3），将计算机的资源分配给运行的进程。服务器计算机，特别是在云环境中，可以同时运行多个操作系统实例。这是通过让管理程序(§2.3)在计算机上运行的操作系统实例之间分配计算机的资源来实现的。
</p-ch>
<p-en>
	System software uses virtualization techniques to isolate each piece of software that it manages (process or operating system) from the rest of the software running on the computer. This isolation is a key tool for keeping software complexity at manageable levels, as it allows application and OS developers to focus on their software, and ignore the interactions with other software that may run on the computer.
</p-en>
<p-ch>
	系统软件使用虚拟化技术将其管理的每一个软件（进程或操作系统）与计算机上运行的其他软件隔离开来。这种隔离是将软件复杂性保持在可管理水平的一个关键工具，因为它使应用程序和操作系统开发人员能够专注于他们的软件，而忽略与可能在计算机上运行的其他软件的相互作用。
</p-ch>
<p-en>
	A key component of virtualization is address translation (§2.5), which is used to give software the impression that it owns all the memory on the computer. Address translation provides isolation that prevents a piece of buggy or malicious software from directly damaging other software, by modifying its memory contents.
</p-en>
<p-ch>
	虚拟化的一个关键组成部分是地址转换(§2.5)，它用于给软件留下它拥有计算机上所有内存的印象。地址转换提供了隔离功能，防止一个有缺陷或恶意的软件通过修改其内存内容而直接损害其他软件。
</p-ch>
<p-en>
	The other key component of virtualization is the software privilege levels (§2.3) enforced by the CPU. Hardware privilege separation ensures that a piece of buggy or malicious software cannot damage other software indirectly, by interfering with the system software managing it.
</p-en>
<p-ch>
	虚拟化的另一个关键部分是CPU强制执行的软件权限级别（§2.3）。硬件权限分离保证了一个错误的或恶意的软件不能通过干扰管理它的系统软件而间接损害其他软件。
</p-ch>
<p-en>
	Processes express their computing power requirements by creating execution threads, which are assigned by the operating system to the computer's logical processors. A thread contains an execution context (§2.6), which is the information necessary to perform a computation. For example, an execution context stores the address of the next instruction that will be executed by the processor.
</p-en>
<p-ch>
	进程通过创建执行线程来表达自己的计算能力需求，执行线程由操作系统分配给计算机的逻辑处理器。一个线程包含一个执行上下文（§2.6），它是执行计算所必需的信息。例如，一个执行上下文存储了处理器将要执行的下一条指令的地址。
</p-ch>
<p-en>
	Operating systems give each process the illusion that it has an infinite amount of logical processors at its disposal, and multiplex the available logical processors between the threads created by each process. Modern operating systems implement preemptive multithreading, where the logical processors are rotated between all the threads on a system every few milliseconds. Changing the thread assigned to a logical processor is accomplished by an execution context switch (§2.6).
</p-en>
<p-ch>
	操作系统给每个进程一种错觉，认为它有无限多的逻辑处理器可供支配，并在每个进程创建的线程之间复用可用的逻辑处理器。现代操作系统实现了抢占式多线程，即逻辑处理器每隔几毫秒就在系统的所有线程之间轮换一次。改变分配给逻辑处理器的线程是通过执行上下文切换来完成的（§2.6）。
</p-ch>
<p-en>
	Hypervisors expose a fixed number of virtual processors (vCPUs) to each operating system, and also use context switching to multiplex the logical CPUs on a computer between the vCPUs presented to the guest operating systems.
</p-en>
<p-ch>
	管理程序将固定数量的虚拟处理器(vCPU)暴露给每个操作系统，还使用上下文切换将计算机上的逻辑CPU在呈现给客体操作系统的vCPU之间复用。
</p-ch>
<p-en>
	The execution core in a logical processor can execute instructions and consume data at a much faster rate than DRAM can supply them. Many of the complexities in modern computer architectures stem from the need to cover this speed gap. Recent Intel CPUs rely on hyperthreading (§2.9.4), out-of-order execution (§2.10), and caching (§2.11), all of which have security implications.
</p-en>
<p-ch>
	逻辑处理器中的执行核心可以以比DRAM提供的速度快得多的速度执行指令和消耗数据。现代计算机体系结构中的许多复杂性都源于弥补这种速度差距的需要。最近的英特尔CPU依赖于超线程(§2.9.4)、无序执行(§2.10)和缓存(§2.11)，所有这些都有安全方面的影响。
</p-ch>
<p-en>
	An Intel processor contains many levels of intermediate memories that are much faster than DRAM, but also orders of magnitude smaller. The fastest intermediate memory is the logical processor's register file (§2.2, §2.4, §2.6). The other intermediate memories are called caches (§2.11). The Intel architecture requires application software to explicitly manage the register file, which serves as a high-speed scratch space. At the same time, caches transparently accelerate DRAM requests, and are mostly invisible to software.
</p-en>
<p-ch>
	英特尔处理器包含了很多级别的中间存储器，它们比DRAM快得多，但体积也小得多。速度最快的中间存储器是逻辑处理器的寄存器文件（§2.2、§2.4、§2.6）。其他中间存储器称为缓存（§2.11）。英特尔架构要求应用软件明确管理寄存器文件，它作为一个高速的抓取空间。同时，缓存透明地加速了DRAM的请求，对软件来说大多是不可见的。
</p-ch>
<p-en>
	Intel computers have multiple logical processors. As a consequence, they also have multiple caches distributed across the CPU chip. On multi-socket systems, the caches are distributed across multiple CPU chips. Therefore, Intel systems use a cache coherence mechanism (§2.11.3), ensuring that all the caches have the same view of DRAM. Thanks to cache coherence, programmers can build software that is unaware of caching, and still runs correctly in the presence of distributed caches. However, cache coherence does not cover the dedicated caches used by address translation (§2.11.5), and system software must take special measures to keep these caches consistent.
</p-en>
<p-ch>
	英特尔计算机拥有多个逻辑处理器。因此，它们也有分布在CPU芯片上的多个缓存。在多插槽系统上，缓存分布在多个CPU芯片上。因此，英特尔系统使用缓存一致性机制（§2.11.3），确保所有的缓存对DRAM有相同的视图。得益于缓存一致性，程序员可以构建不知道缓存的软件，在分布式缓存存在的情况下仍然可以正确运行。但是，缓存一致性并不涵盖地址转换所使用的专用缓存（§2.11.5），系统软件必须采取特殊措施来保持这些缓存的一致性。
</p-ch>
<p-en>
	CPUs communicate with the outside world via I/O devices (also known as peripherals), such as network interface cards and display adapters (§2.9). Conceptually, the CPU communicates with the DRAM chips and the I/O devices via a system bus that connects all these components
</p-en>
<p-ch>
	CPU通过I/O设备(也称为外设)与外界通信，如网络接口卡和显示适配器(§2.9)。从概念上讲，CPU与DRAM芯片和I/O设备的通信是通过系统总线来实现的，系统总线将所有这些部件连接起来。
</p-ch>
<p-en>
	Software written for the Intel architecture communicates with I/O devices via the I/O address space (§2.4) and via the memory address space, which is primarily used to access DRAM. System software must configure the CPU's caches (§2.11.4) to recognize the memory address ranges used by I/O devices. Devices can notify the CPU of the occurrence of events by dispatching interrupts (§2.12), which cause a logical processor to stop executing its current thread, and invoke a special handler in the system software (§2.8.2).
</p-en>
<p-ch>
	为Intel架构编写的软件通过I/O地址空间(§2.4)和内存地址空间(主要用于访问DRAM)与I/O设备进行通信。系统软件必须配置CPU的缓存（§2.11.4），以识别I/O设备使用的内存地址范围。设备可以通过发送中断(§2.12)通知CPU事件的发生，使逻辑处理器停止执行当前线程，并调用系统软件中的特殊处理程序(§2.8.2)。
</p-ch>
<p-en>
	Intel systems have a highly complex computer initialization sequence (§2.13), due to the need to support a large variety of peripherals, as well as a multitude of operating systems targeting different versions of the architecture. The initialization sequence is a challenge to any attempt to secure an Intel computer, and has facilitated many security compromises (§2.3).
</p-en>
<p-ch>
	英特尔系统有一个非常复杂的计算机初始化序列(§2.13)，因为需要支持大量的外设，以及针对不同版本的架构的多种操作系统。初始化序列对任何试图保护英特尔计算机的安全都是一个挑战，并促成了许多安全漏洞(§2.3)。
</p-ch>
<p-en>
	Intel's engineers use the processor's microcode facility (§2.14) to implement the more complicated aspects of the Intel architecture, which greatly helps manage the hardware's complexity. The microcode is completely invisible to software developers, and its design is mostly undocumented. However, in order to evaluate the feasibility of any architectural change proposals, one must be able to distinguish changes that can be implemented in microcode from changes that can only be accomplished by modifying the hardware.
</p-en>
<p-ch>
	英特尔的工程师使用处理器的微代码设施（§2.14）来实现英特尔架构中比较复杂的方面，这对管理硬件的复杂性有很大的帮助。软件开发人员完全看不到微代码，它的设计大多没有记录。然而，为了评估任何架构变更建议的可行性，我们必须能够区分可以在微代码中实现的变更和只能通过修改硬件来实现的变更。
</p-ch>

</body>
</html>	